Pretty much every method is going to use a central database which is out of your control and is, necessarily, a privacy vulnerability.

The best option would be a cellular implementation but those are going to be necessarily large and require regular charging. But such a device would be very obvious to any would-be thief.

The only privacy vulnerability there would be the same one you get with any cellular device; location tracking via IMEI.